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DETAILED ACTION 

1 . Claims 1-7, 16-22, 31-37 and 46-52 have been examined. 

Election/Restrictions 

2. Applicant's election with traverse of Group I (claims 1-7, 16-22, 31-37 and 46-52) 
in the reply filed on 25 January 2007 is acknowledged. The traversal is on the 
ground(s) that subcombination characterization in the action is incorrect and failed to 
recognize the proper relationship between the claims. 

This is not found persuasive because: 

On page 2 of the Applicant's argument, the Applicant argues "The Group II 
claims are directed at a method for making such an obfuscated application program" 
and on page 3 of the Applicant's argument, the Applicant argues, "The group II claims 
recited a method of making such an encoded opcode and group III claims at the 
product. Thus the subcombination characterization in the action is incorrect... which is 
required by the Rules... product, process of making, and process of using...". 

The examiner respectfully responds that, group II claims recite a method of 
"creating an opcode value encoding scheme" (Please see pages 69, 73, 77 and 80 
of the original claims). Thus, contrary to the Applicant's argument, Group II claims are 
not a method of making such an encoded opcode and not a method of method for 
making such an obfuscated application program. 

Additionally, the examiner respectfully points out, group III claims recite a 
memory storing a data structure, which includes information used by the application 
program execute an obfuscated application program (Please see page 82 of the original 
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claims). Therefore, contrary to the Applicant's argument, Group II claims are not a 
product. 

Therefore, the process of making and product are not presented in the Group II 
and Group III claims as the Applicant argues. The subcombination characterization in 
the action is correct and claims 8-15, 23-30, 38-45, 53-60 and 61-63 are withdrawn from 
consideration. 

The requirement is still deemed proper and is therefore made FINAL. 

Drawings 

3. The drawings are objected to: For example, as failing to comply with 37 
CFR 1.84(p)(4) because reference characters "218" has been used to designate both 
"numeric keyboard" and "alphanumeric keyboard" (fig. 2); reference character "485" 
has been used to designate both "obfuscation descriptor" and "virtual machine" (fig. 4); 
etc. Corrected drawing sheets in compliance with 37 CFR 1.121(d) are required in reply 
to the Office action to avoid abandonment of the application. Any amended replacement 
drawing sheet should include all of the figures appearing on the immediate prior version 
of the sheet, even if only one figure is being amended. Each drawing sheet submitted 
after the filing date of an application must be labeled in the top margin as either 
"Replacement Sheet" or "New Sheet" pursuant to 37 CFR 1.121(d). If the changes are 
not accepted by the examiner, the applicant will be notified and informed of any required 
corrective action in the next Office action. The objection to the drawings will not be held 
in abeyance. 
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4. The drawings are objected to as failing to: For example, comply with 37 CFR 
1.84(p)(5) because they include the following reference character(s) not mentioned in 
the description: 115, 120, 140 (fig. 1); 325, 330, 335, 340, 370 (fig. 3); 510 (fig. 5B), etc. 
Corrected drawing sheets in compliance with 37 CFR 1.121(d), or amendment to the 
specification to add the reference character(s) in the description in compliance with 37 
CFR 1.121(b) are required in reply to the Office action to avoid abandonment of the 
application. Any amended replacement drawing sheet should include all of the figures 
appearing on the immediate prior version of the sheet, even if only one figure is being 
amended. Each drawing sheet submitted after the filing date of an application must be 
labeled in the top margin as either "Replacement Sheet" or "New Sheet" pursuant to 37 
CFR 1.121(d). If the changes are not accepted by the examiner, the applicant will be 
notified and informed of any required corrective action in the next Office action. The 
objection to the drawings will not be held in abeyance. 

5. This is not intended to be a complete list of objections to the drawings. 
Applicant is required to review and correct the drawings to place them in 
compliance. 

Specification 

6. The disclosure is objected to because of the following informalities: the reference 
to application numbers provided in page 2 needs to be updated to reflect applications 
that have matured into patents. Appropriate correction is required. 

7. The disclosure is objected to because of the following informalities: "ATM" (page 
18). These terms have not been defined. Appropriate correction is required. 
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8. The disclosure is objected to because of on page 1 8, paragraph [001 5], "The 
process can be implemented as instructions executed by such hardware, hardware 
alone, or any combination thereof. The software... readable by a machine". It appears 
to the examiner that the sentence is contradicted to itself. If only hardware alone, where 
is any combination thereof. The examiner assumes the Applicant meant "The process 
can be implemented as instructions executed by such software, hardware alone, or any 
combination thereof...." Appropriate correction is required. 

Claim Rejections - 35 USC § 101 

9. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

10. Claims 31-37 are rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. 

Claims 31-37 contain "means-plus function" limitations and appear to be 
systems. However, it is noted on page 18, paragraph [0015], the apparatus can be 
software alone. Therefore, these claim limitations can be reasonably interpreted as 
software per se. The claims are directed to systems of functional descriptive material 
per se, and hence non-statutory. 
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Claim Rejections - 35 USC § 102 

1 1 . The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

12. Claims 1-2, 4, 16-17, 19, 31-32, 34 and 46-47, 49 are rejected under 35 
U.S.C. 102(e) as being anticipated by Zeman et al. (U.S. Pub. No. 2004/0003264). 

As per claims 1 and 31, Zeman et al. discloses a method/apparatus for 
executing an obfuscated application program, the method/apparatus comprising: 

receiving an obfuscated application program, said obfuscated 
application program comprising at least one instruction opcode value encoded 
using one of a plurality of instruction set opcode value encoding schemes ("Sometime 
before an obfuscated function is called, it must be deobfuscated..." - e.g. par. [0082], 
"At step 902, the deobfuscation process is triggered. Deobfuscation is triggered at 
some point in time before the function is called" - e.g. par. [0083], par. [0073]- [0077] 
and Fig. 8); 

determining a dispatch table associated with said application program, said 
dispatch table corresponding to said one of a plurality of instruction set 
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opcode value encoding schemes ("The original bytes, and their offsets into the 
function, are saved in a table so that the function can later be "de-obfuscated" by 
restoring they bytes to their original values" - e.g. par. [0006], "At step 810, a healing 
table (e.g., healing table 600, shown in Fig. 6) is created to aid in the deobfuscation of 
code prior to its execution... At step 812, the healing table is added to the 
executable..." -e.g. par. [0078] - [0079]); and 

executing said application program using said associated dispatch table ("The 
deobfuscation routine consults the table and restores the replaced bytes in the function 
to their original values" - e.g. par. [0008] , "...This pre-obfuscation value is determined, 
preferably, by looking up the value on healing table 600... At some subsequent point, 
the function is called (step 912), and execution of the function proceeds (step 914) - 
e.g. par. [0084] and fig. 9. Please note healing table 600 corresponds to Applicant's 
dispatch table). 

As per claims 2 and 32, Zeman et al. discloses a method/apparatus as applied 
above in claims 1 and 31 above. Zeman et al. further discloses wherein said 
determining comprises generating said dispatch table in response to said receiving 
("While step 810 is shown below step 808 in Fig. 8, it should be noted that the healing 
table does not have to be created subsequent to the replacement of bytes in the 
original code. In fact, the healing table is preferably created while the bytes are being 
replaced). 
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As per claims 16-17, Zeman et al. discloses the claimed method of steps as 
applied above in claims 1-2. Therefore, Zeman et al. discloses the claimed program of 
instructions embodied in a program storage device for carrying out the method of 
steps. 

As per claims 46-47, they are rejected using the same rationale as rejecting 
claims 31-32 above. 

As per claims 4 and 34, Zeman et al. discloses a method/apparatus for 
executing an obfuscated application program, the method/apparatus comprising: 

receiving an obfuscated application program, said obfuscated application 
program comprising at least one instruction opcode value encoded 
using one of a plurality of non-standard instruction set opcode value encoding 
schemes ("In a preferred embodiment, healing table 600 is stored... in a "scrambled" 
form... .For example, healing table 600 can be XOR'd with a known value. This XOR 
technique allows the content of healing table 600 to be recovered easily, while making 
its presence within executable 10(1) somewhat more obscure that it would be if healing 
table 600 were. stored in the clear" - e.g. par. [0071] and fig. 7. Please note 
"scrambled" healing table corresponds to Applicant's non-standard instruction set 
opcode value); 

determining an instruction set opcode value encoding scheme 
associated with said obfuscated application program ("The original bytes, and their 
offsets into the function, are saved in a table so that the function can later be "de- 
obfuscated" by restoring they bytes to their original values" - e.g. par. [0006], "At step 
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810, a healing table (e.g., healing table 600, shown in Fig. 6) is created to aid in the 
deobfuscation of code prior to its execution... At step 812, the healing table is added to 
the executable..." - e.g. par. [0078] - [0079]); 

rewriting said application program using a standard opcode value encoding 
scheme if said received application program is not encoded using said standard 
opcode value encoding scheme ("An example of an executable rewritten according to 
step 812 is discussed above in connection with Fig. 7" - e.g. par. [0079]; and 

executing said application program using a dispatch table associated with said 
standard opcode value encoding scheme ("The deobfuscation routine consults the 
table and restores the replaced bytes in the function to their original values" - e.g. par. 
[0008] , "...This pre-obfuscation value is determined, preferably, by looking up the 
value on healing table 600... At some subsequent point, the function is called (step 
912), and execution of the function proceeds (step 914) - e.g. par. [0084] and fig. 9. 
Please note healing table 600 corresponds to Applicant's dispatch table). 

As per claim 19, Zeman et al. discloses the claimed method of steps as applied 
above in claim 4. Therefore, Zeman et al. discloses the claimed program of 
instructions embodied in a program storage device for carrying out the method of 
steps. 

As per claim 49, it is rejected using the same rationale as rejecting claim 34 

above. 



Application/Control Number: 10/672,700 Page 10 

Art Unit: 2135 

13. Claims 5-6? 20-21, 35-36 and 50-51 are rejected under 35 U.S.C. 102(e) as 
being anticipated by Kiddy (U.S. Patent No. 6,694,435) 

As per claims 5 and 35, Granger et al. discloses a method/apparatus for 
application program obfuscation, the method/apparatus comprising: 

reading an application program comprising code (e.g. col. 5, lines 5-25); 

transforming said application program code into transformed application program 
code that uses one of a plurality of opcode value encoding schemes of a dispatch table 
associated with said application program (e.g. col. 5, lines 45-67 and col. 6, lines 1-47 
); and 

sending said transformed application program code (e.g. col. 7, lines 13-30). 

As per claims 6 and 36, Kiddy discloses a method/apparatus as applied above 
in claims 5 and 35. Kiddy further discloses comprising receiving an application 
program request from a user device, said transforming occurring in response to said 
receiving (e.g. col. 6, lines 15-65 and col. 7, lines 13-30). 

As per claims 20-21, Kiddy discloses the claimed method of steps as applied 
above in claims 5-6. Therefore, Kiddy discloses the claimed program of instructions 
embodied in a program storage device for carrying out the method of steps. 

As per claims 50-51, they are rejected using the same rationale as rejecting 
claims 35-36 above. 
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Claim Rejections - 35 USC § 103 

14. The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1 , 148 
USPQ 459 (1 966), that are applied for establishing a background for determining 
obviousness under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 

15. This application currently names joint inventors. In considering patentability of 
the claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of 
the various claims was commonly owned at the time any inventions covered therein 
were made absent any evidence to the contrary. Applicant is advised of the obligation 
under 37 CFR 1 .56 to point out the inventor and invention dates of each claim that was 
not commonly owned at the time a later invention was made in order for the examiner to 
consider the applicability of 35 U.S.C. 103(c) and potential 35 U.S.C. 102(e), (f) or (g) 
prior art under 35 U.S.C. 103(a). 

16. Claims 3, 18, 33 and 48 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Zeman et al (U.S. Pub. No. 2004/0003264). 

As per claims 3 and 33, Zeman et al. discloses a method/apparatus as applied 
above in claims 1 and 31 above. Zeman et al. does not expressly disclose wherein 
said determining comprises selecting a dispatch table from a plurality of dispatch tables 
in response to said receiving, said plurality of dispatch tables stored in a memory. 
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The examiner takes official notice that selecting a table from a plurality of tables 
is common knowledge in the art at the time of the invention. 

It would have been obvious to a person with ordinary skill in the art at the time of 
the invention to combine the above common knowledge into Zeman et al.'s 
method/apparatus. 

The motivation of doing so would have been to select the right table in order to 
"consults the table and restores the replaced bytes in the function to their original 
values" since "the table contains the original byte values", as disclosed by Zeman et al. 
(par. [0008]) 

As per claims 18, Zeman et al. discloses the claimed method of steps as applied 
above in claims 3. Therefore, Zeman et al. discloses the claimed program of 
instructions embodied in a program storage device for carrying out the method of steps. 

As per claims 48, it is rejected using the same rationale as rejecting claim 33 

above. 

17. Claims 7, 22, 37 and 52 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Kiddy as applied to claims 5 and 35 above, and further in view of 
Drake (U.S. Patent No. 6,006,328). 

As per claims 7 and 37, Kiddy discloses a method/apparatus as applied above 
in claims 5 and 35. Kiddy does not expressly disclose using encryption. 
However, Drake discloses after said creating, applying a cryptographic process to said 
obfuscated application program together with a cryptographic key to create an 
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encrypted obfuscated application program; and said sending comprises sending said 
encrypted obfuscated application program (e.g. fig. 6, col. 4, lines 40-67, col. 5, lines 1- 
35, col. 16, lines 1-67). 

It would have been obvious to one with ordinary skill in the art at the time of the 
invention to incorporate encryption with the method/apparatus of Kiddy. 

The motivation of doing so would have been to provide further security to the 
application (Drake, summary). 

As per claim 22, Kiddy-Drake disclose the claimed method of steps as applied 
above in claim 7. Therefore, Kiddy-Drake disclose the claimed program of instructions 
embodied in a program storage device for carrying out the method of steps. 

As per claim 52, it is rejected using the same rationale as rejecting claim 37 
above. 

Double Patenting 

18. Claims 1-7, 16-22, 31-37 and 46-52 are provisionally rejected under the judicially 
created doctrine of nonstatutory obviousness-type double patenting as being 
unpatentable over claims 1-48 of copending Application No. 10/672,183. Although the 
conflicting claims are not identical, they are not patentably distinct from each other 
because the subject matter claimed in the instant application is also claimed in the 
referenced copending application. 

1 9. This is a provisional obviousness-type double patenting rejection because the 
conflicting claims have not in fact been patented. 
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20. The subject matter claimed in the instant application is fully claimed in the 
referenced copending application and would be covered by any patent granted on that 
copending application since the referenced copending application and the instant 
application are claiming common subject matter, as follows: 

The instant application claims a method for executing an obfuscated application 
program, the method comprising: receiving an obfuscated application program, said 
obfuscated application program comprising at least one instruction opcode value 
encoded using one of a plurality of instruction set opcode value encoding schemes; 
determining a dispatch table associated with said application program, said 
dispatch table corresponding to said one of a plurality of instruction set 
opcode value encoding schemes; and executing said application program using 
said associated dispatch table (Claim 1). 

The copending application claims a method for executing an obfuscated 
application program, the method comprising: receiving an obfuscated application 
program, said obfuscated application program comprising at least one instruction 
opcode value encoded using one of a plurality of instruction set opcode value encoding 
schemes; receiving an application program instruction corresponding to a current 
instruction counter value; selecting an instruction dispatch table based at 
least in part on said current instruction counter value; and executing said 
application program instruction using said selected instruction dispatch table (Claim 1 ). 

21. Claims 1-7, 16-22, 31-37 and 46-52 of the instant application are envisioned by 
copending Application No. 1 0/672, 183's claims 1-48 in that claims 1-48 of the 
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copending application contain all the limitations of claims 1-7, 16-22, 31-37 and 46-52 
of the instant application therefore are not patently distinct from the copending 
application claims and as such are unpatentable for obvious-type double patenting 
because it would have been obvious to do the obfuscation in copending application 
conditional to some event and/or using a table to select/permute instructions. 
22. Claims 1-7, 16-22, 31-37 and 46-52 are provisionally rejected under the judicially 
created doctrine of nonstatutory obviousness-type double patenting as being 
unpatentable over claims 1-52 of copending Application No. 10/673,021. Although the 
conflicting claims are not identical, they are not patentably distinct from each other 
because the subject matter claimed in the instant application is also claimed in the 
referenced copending application. 

23. This is a provisional obviousness-type double patenting rejection because the 
conflicting claims have not in fact been patented. 

24. The subject matter claimed in the instant application is fully claimed in the 
referenced copending application and would be covered by any patent granted on that 
copending application since the referenced copending application and the instant 
application are claiming common subject matter 

25. Claims 1-7, 16-22, 31-37 and 46-52 of the instant application are envisioned by 
copending Application No. 10/673,02rs claims 1-48 in that claims 1-52 of the 
copending application contain all the limitations of claims 1-7, 16-22, 31-37 and 46-52 
of the instant application therefore are not patently distinct from the copending 
application claims and as such are unpatentable for obvious-type double patenting 
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because it would have been obvious to do the obfuscation in copending application 
conditional to some event and/or using a table to select/permute instructions. 

Conclusion 

26. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. (See PTO-892). 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to April Y. Shan whose telephone number is (571 ) 270- 
1014. The examiner can normally be reached on Monday - Friday, 8:00 a.m. - 5:00 
p.m., EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Y. Vu can be reached on (571) 272-3859. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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